aiqbench analysis
A malicious LiteLLM 1.107.0 release on PyPI and Docker Hub shipped a credential stealer and remote code loader, putting LLM provider keys and other secrets at risk for teams that install it directly or through its 2,000-plus dependents. The core issue is software supply-chain security in AI developer tooling, so teams should check for version 1.107.0, rotate exposed keys, and audit installs that pull LiteLLM transitively. The Chainguard protection claims come from a vendor and are not independently verified.
LiteLLM attacked again: Malicious 1.107.0 wheels on PyPI and Docker Hub (October 2026)
LiteLLM 1.107.0 on PyPI and Docker shipped a credential stealer and a remote code loader. See how Chainguard kept customers protected.
What happened: On October 21, 2026, an attacker published LiteLLM 1.107.0 to PyPI with a credential stealer and a remote code loader inside all seven wheels. The official LiteLLM Docker images for the same version carry the same payload. What happened: On October 21, 2026, an attacker published LiteLLM 1.107.0 to PyPI with a credential stealer and a remote code loader inside all seven wheels. The official LiteLLM Docker images for the same version carry the same payload. Affected artifacts: litellm==1.107.0 on PyPI, plus the ghcr.io/berriai/litellm, litellm-database, and litellm-non_root images and docker.io/litellm/litellm under the v1.107.0, latest, main-latest, and main-stable tags. Affected artifacts: litellm==1.107.0 on PyPI, plus the ghcr.io/berriai/litellm, litellm-database, and litellm-non_root images and docker.io/litellm/litellm under the v1.107.0, latest, main-latest, and main-stable tags. Scale: litellm had more than 100 million downloads on PyPI in the last month. More than 2,000 packages depend on it, so many teams install it without a direct reference. Scale: litellm had more than 100 million downloads on PyPI in the last month. More than 2,000 packages depend on it, so many teams install it without a direct reference. Risk: Python runs the payload each time it starts, even when no code imports litellm. The stealer takes…
Excerpt shown under the publisher's RSS terms · 200 words · full text and figures are on the publisher's site
Related coverage
ContextLeak: Exfiltrating LLM Agent Context via Malicious Tools
arXiv · Sep 1, 2026
Defending Against Malicious Finetuning by Scaling Train-time Adversarial Attacks
arXiv · Sep 30, 2026
Studying the role of Sandboxing for AI Control
LessWrong · Jul 17, 2026
WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents
arXiv · Sep 24, 2026